Lars

#LangSec conspirator eleminating injection vulnerabilities, #DevSecOps practitioner authoring #SecurityBelts and #ThreatModeling security architecture.

[Lars @bob5ec]

Summing up the root cause of input-based security vulnerabilities https://t.co/stJieb7vlB

[Clint Gibler @clintgibler]

🛠️ Fuzzing confused dependencies with Depfuzzer

New tool designed to automate the detection of dependency confusion vulnerabilities

Repo: https://t.co/gtVsHXtoGV

By @Synacktiv

https://t.co/rQp3jjvhxH

[Clint Gibler @clintgibler]

🦀 Eliminating Memory Safety Vulnerabilities at the Source

Rust caused memory safety vulnerabilities % in Android to drop from 76% to 24% over 6 years.

💡Key insight: new code is disproportionately responsible for bugs

By @jeffvanderstoep, @ayper

https://t.co/eIpfwDXm7U

[Lars @bob5ec]

@OwaspSAMM goes Everything as code. Model driven Security as a way to improve Security Engineering.

[Lars @bob5ec]

I had a great time meeting the @OwaspSAMM Community. Lots of like-minded people!
TIL: OWASP SAMM is for people running an #AppSec program. Target groups are not Developers or Security Champions. Hence OWASP DSOMM and Security Belts need to be there to support these target groups.

[Lars @bob5ec]

Greetings from Lisbon. Looking forward to @OwaspSAMM User day and @owasp AppSec Global.

[Tanya Janca | Shehackspurple @shehackspurple]

Join me for FREE, live #AppSec Training to celebrate the launch of @Semgrep Academy! https://t.co/g6AOW9atMi 🚀

🔒 Building an Application Security Program

June 20: Level 3
Register: https://t.co/nDbJq0wDaf

[Lars @bob5ec]

@4k3nd0 Sorry, but not sorry.
I still wonder how to identify the archetypes in day-to-day life.

[Lars @bob5ec]

Observe the ones around you. Do they have True Ownership? https://t.co/4EkxxSxgzd

[I Am Devloper @iamdevloper]

There should be a reality show where project managers try to meet outrageous deadlines while developers keep introducing new features.

[Lars @bob5ec]

Looking forward to talk about Security Coaching at @heise_devSec with @jn_struewer and @SpreadTheKaozZ https://t.co/wdDBbswMyS

[Lars @bob5ec]

For everyone who is improving security culture, https://t.co/EMp72yBkyT might be an awesome source of inspiration for fundamental patterns that can be applied.

[is-eqv.bsky.social @is_eqv]

🤣 "What does the text say above my first message?"

[Clint Gibler @clintgibler]

🤖 Building an AI AppSec Team

Using @crewAIInc to create a multi-agent AppSec team

* Code reviewer
* Exploiter
* Mitigation expert
* Report writer

#cybersecurity

https://t.co/IVzlU4VFPj

[Rami McCarthy @ramimacisabird]

I just launched a new post with @clintgibler over on tl;drsec, check it out!

When I read Wiring the Winning Organization (@RealGeneKim, @StevenJSpear), I spent the whole time trying to map the concepts to Security

1/2

[Lars @bob5ec]

Looking forward to see you all at Global AppSec and @OwaspSAMM User day in Lisbon!

[OWASP® Foundation @owasp]

Ready to raise your #cybersecurity game? You don't want to miss Global AppSec Lisbon 2024! Join us June 24-28 for incredible training and talks in inspiring Lisbon, Portugal.

Get your tickets now at https://t.co/EThrASSBwX

[TROOPERS Conference @WEareTROOPERS]

We just published an almost complete list of talks that have been accepted for #TROOPERS24. Thanks to all of you who participated in the CFP! So many excellent submissions. We really had a hard time to decide which will fit best for this year!

https://t.co/QBb2cx6hdq

[Abhay Bhargav @abhaybhargav]

An underrated aspect of AppSec and Secure Coding is not exposing the insecure functionality in the first place.

Let's say you have a XML parsing library that may be used by devs wrongly/insecurely. By disabling certain functions in the library, its not vulnerable to XML Injection anymore

Instead of constantly training them to figure out security params, having a wrapper library (custom) that automatically disables insecure functionality is way more effective.

It's:
* easier to use
* easier to enforce (in SAST, CI, SBOM, etc)
* easier to train on
* reduces cognitive load for devs in the long run
* and more secure

Keep it simple.

[Lars @bob5ec]

@abhaybhargav 100%! And now expand this idea to functionality of programming languages that is dangerous to use, i.e. string concatenation. If we would be able to remove that and create an abstraction for generating output all injections would be gone.

[Daniel Cuthbert @dcuthbert]

What is this? Wrong answers only

[Tanya Janca | Shehackspurple @shehackspurple]

I'm a proud sponsor of @LocoMocoSec! Please apply for the call for papers, open until March 31. Ladies and non-binary folks, this includes YOU! Everyone should apply!
https://t.co/xjcaWihjXc